@knowttl/gitea-axi 0.1.1 → 0.1.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) knowttl
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -71,6 +71,7 @@ Full workflow run APIs require Gitea 1.24 or later; the retained workflow, artif
 ### Search
 
 `search issues|prs|repos|commits "text"` searches at most 20 pages and 1000 candidates per collection, then filters, sorts and applies the total output limit (default 1000).
+Search sorts creation and update times chronologically across time zone offsets before applying the output limit.
 Issue and PR searches support exact arbitrary author and assignee names and comma-separated label ANY matching; an unknown label alone matches nothing.
 Use `--repo OWNER/NAME` for repository scope or `--owner OWNER` for issue, PR and repository searches.
 Repository search supports `--language` and integer `--stars` comparisons.
@@ -97,27 +98,40 @@ gitea-axi config path
 gitea-axi doctor
 ```
 
+Raw `api GET` contents reads support root and nested directories, returning directory arrays (including empty arrays) or individual file, symlink and submodule objects under `data`.
+Nullable contents and link fields are accepted while non-null values retain their schema type checks.
+Use literal slashes for nested paths such as `repos/OWNER/NAME/contents/src/main.ts`, `repos/OWNER/NAME/editorconfig/src/main.ts` and Git ref filters such as `repos/OWNER/NAME/git/refs/heads/main`.
+This multi-segment support applies only to those GET routes; other route parameters and raw writes retain single-segment matching.
+Encoded route separators and traversal remain refused.
+
 Anonymous reads require an explicit origin; repository selection follows the rules below.
 Anonymous HTTP reads require `--allow-insecure-http` for that selected origin.
 The tool follows no redirects and never imports tea or Git credentials.
 Output uses TOON; structured errors use stdout, with exit 1 for operational failures and exit 2 for usage errors.
 Business reads share a 30-second deadline, except check watches use their explicit timeout; each request has a 2,000,000-byte response limit.
+The check-watch timeout includes initial repository reads; polling cannot extend the client's deadline.
 `repo view` instead gives each of its server version, specification and repository requests a separate 30-second timeout.
 An explicit repository wins over a matching local origin remote; a remote never changes the selected profile.
-`-R` aliases `--repo` after an explicit command, with the same duplicate-selector checks.
-For the default dashboard, use `gitea-axi --repo OWNER/NAME`; root-level `-R` remains unsupported.
+`-R` aliases `--repo`, with the same duplicate-selector checks.
+For the default dashboard, use `gitea-axi --repo OWNER/NAME` or `gitea-axi -R OWNER/NAME`.
 Hosted repository reads require an explicit repository.
-Lists default to 30 returned records, except `run list` and `release list` default to 10; collection scans are bounded to 20 pages or 1000 unique records.
+Lists default to 30 returned records, except `run list` and `release list` default to 10; collection scans stop at 20 pages or at least 1000 unique records and retain at most 1000.
+Automatic page queries apply only to routes whose retained Gitea specification declares a `page` parameter.
+Unpaginated collections, including inline review comments and attachment metadata, are complete unless the server supplies a continuation link or the collection exceeds the record bound; a response of 50 records alone does not imply another page.
 Issue and PR lists filter before globally sorting the collected records and applying the return limit.
 Milestone selectors use exact names, including numeric-looking names.
-List output distinguishes unknown vendor totals from known totals and reports continuation and truncation.
+List output distinguishes unknown totals from known totals and reports continuation and truncation.
+For an unpaginated collection without a continuation link, a missing server total is inferred from the unique records received.
 Issue, PR and run lists expose `unfiltered_total` as the server count before client-side filtering; `total` is the filtered count when the bounded read is complete, otherwise null.
 Truncated output includes guidance to raise `--limit` (maximum 1000), or use raw API pagination when the bounded read is incomplete.
 The dashboard shows a compact repository projection (ID, full name, visibility, default branch, open issue and PR counts, and update time), plus up to five issues, PRs, labels, releases and task summaries per section.
 Dashboard sections report permission failures as partial results and point truncated sections to the corresponding standalone list command with `--repo` and `--limit`.
 Issue and PR bodies default to 1000 characters, diffs to 10000 characters, and rendered output to 100000 characters.
 `--full` expands bodies and diffs within the response and output ceilings.
-`pr checks` exits 8 for pending checks and 1 for failed or absent checks; watches require an explicit deadline and accept cancellation.
+Diffs retain an unchanged source prefix sized to fit the serialized output, including escaping and metadata; `chars` reports the original length and `truncated` indicates omitted text.
+`pr checks` exits 8 for pending checks and 1 for failed or absent checks; watches require an explicit deadline.
+During check polling, SIGINT or SIGTERM aborts in-flight PR and status requests, including paginated responses, and returns `cancelled: true` with exit code 8.
+Cancellation preserves the last completed check result; before any completed result, it returns empty items and zero counts, with the head SHA if already read, otherwise null.
 Commits without statuses return an empty check result; watches continue waiting for checks to register until the deadline or cancellation.
 `--fields` refuses unknown names and fields without an evidenced Gitea equivalent, and cannot combine with detail expansion flags.
 PR statusCheckRollup explicitly identifies partial commit statuses, and `fullDatabaseId` is a numeric vendor ID rather than a GraphQL node ID.
@@ -145,8 +159,11 @@ Issue and label deletion require a complete collection and at least one remainin
 
 ### Pull requests
 
+`pr view` includes both user and team review requests in `reviewRequests`: users have `login` and `name`, while teams have `type: team`, `id` and `name`.
 Pull request mutations include `create`, `edit`, `close`, `reopen`, `comment`, `update-branch` and `merge`.
 Creation requires explicit `--title`, `--base` and `--head` branch names in the selected repository.
+PR creation, base edits, updates and merges support slash-containing branch names such as `work/topic` and `release/stable`, resolving exact Git refs rather than prefix matches.
+Branch resolution binds commit identities into preview and confirmation while preserving API path separator and traversal protections.
 Cross-repository heads, draft and project inputs remain unavailable.
 Create accepts repeatable `--reviewer` user names and `--team-reviewer` team names, plus issue-style assignees, labels and milestone selectors.
 Edit accepts `--base`, text fields and assignee/label deltas, plus repeatable `--add-reviewer`, `--remove-reviewer`, `--add-team-reviewer` and `--remove-team-reviewer` deltas.
@@ -158,6 +175,7 @@ If the reviewer step fails after creation, the error reports the created PR ID a
 Close with `--comment` records closure and comment as separate steps and reports partial outcomes without retrying.
 Successful writes verify the same PR identity, expected fields and memberships through fresh reads.
 Update-branch verifies that the resulting head contains both its previous head and base commits; conflicts never report completion.
+Verification stops once both commits are proven present, so older base history need not be traversed; it reads at most 1000 commits and refuses completion if that bound prevents proof.
 Merge requires exactly one of `--merge`, `--squash`, `--rebase` or `--method merge|squash|rebase`, and a full `--match-head-commit` SHA.
 It sends the vendor `head_commit_id` precondition and verifies the closed, merged PR, base branch tip and final commit topology.
 Merge commits retain the previous base and checked head as parents; squash uses one new commit on the previous base; rebase verifies the rewritten linear chain and original commit messages.
@@ -250,9 +268,16 @@ gitea-axi issue close 42 --repo OWNER/NAME --comment 'Resolved' --allow-write is
 gitea-axi label create --repo OWNER/NAME --name bug --color ff0000 --allow-write issueCreateLabel --preview
 ```
 
-The preview identifies the exact operations, payload and current preconditions without sending a mutation.
+The preview identifies the exact operations and payload without sending a mutation.
+To fit the rendered output ceiling, previews, write results and reconciliation output may summarize `preconditions`, then `observations`, then `results`, stopping as soon as the output fits.
+Summarized output sets `truncated: true` and lists affected fields in `truncated_fields`.
+Summaries report `summary: true` with `total_items`, `total_fields` or `total_chars`; object summaries retain numeric `id` and `number` when present.
+Summarized observations retain paths, and observations and results retain at most ten entries with their original counts in `observations_total` and `results_total`.
+Preview steps and requested payloads remain complete subject to credential redaction; output that still exceeds the ceiling fails with `OUTPUT_LIMIT`.
 Confirmation binds the credential revision, origin, target, operations, canonical payload and preconditions.
+Display summaries do not weaken confirmation binding or readback verification, which use the complete data.
 Changing any binding requires a fresh preview.
+Organization casing must match the preview exactly.
 For issues that remain present, successful named writes verify identity and the expected final title, body, assignees, labels, milestone and state through fresh reads.
 Pin changes verify the complete expected pin membership; deletion verifies absence of the selected identity and preservation of all remaining records.
 A mismatched or failed verification reports an unknown outcome.
@@ -272,8 +297,13 @@ Each attempt is persisted before dispatch.
 API timeouts, interrupted requests and partial failures return `WRITE_OUTCOME_UNKNOWN`, completed/pending step information and an exact `gitea-axi write reconcile CONFIRMATION_ID` command.
 Dispatched local Git failures retain their specific error code and include reconciliation information; stack recovery follows the [metadata and recovery contract](docs/local-stack-contract.md).
 Reconciliation performs complete metadata reads for inspection and never repeats a mutation.
+If its display is summarized as described above, use targeted reads to inspect the exact identity and requested fields before authorizing another attempt.
+Raw repository edits with a nonempty `name` verify and reconcile through the repository's immutable ID, so a rename does not depend on the old URL.
+Raw wiki edits use the returned escaped `sub_url` for verification and reconciliation; if the response is lost or its page identity is unusable, reconciliation reads the bounded wiki page list instead.
+These read targets preserve the original confirmation binding and attempted-effect identity.
 An unresolved dispatched attempt cannot be replayed by reusing its confirmation or obtaining another preview for the same effect.
-Replay guards also treat repository owner and repository name case variants as the same identity.
+Replay guards also treat repository owner, repository name and organization name case variants as the same identity for named and raw writes.
+Unresolved organization attempts from older versions conservatively block all writes to the same organization at the same origin, including different names or payloads, and return the original attempt's reconciliation command.
 Keep its private receipts until the outcome has been investigated.
 Native Windows write protection and live write commissioning remain unverified; Windows writes are refused.
 
@@ -292,7 +322,7 @@ Incomplete environment profiles report missing variables; profile schema errors
 For file profiles, an explicit profile must match; otherwise exactly one matching profile is required, ignoring `defaultProfile`.
 Without a host selector, file selection uses the explicit profile, otherwise the file's `defaultProfile` or its sole profile; multiple profiles without a selection or default are refused.
 A host selector cannot construct an anonymous origin, bypass tokenOrigin binding or enable HTTP.
-Search commands currently reject `--hostname`; use `GH_HOST` with a matching profile instead.
+Search commands support `--hostname` and `GH_HOST` with the same profile selection and credential binding checks.
 Hosted invocations refuse credential/configuration overrides and ignore ambient `GH_HOST` for the injected Artium profile.
 On Linux, the config file must be owned by the invoking account and must not be group- or world-writable.
 Config files and file SecretRefs must be regular files; symlinks are refused.
@@ -301,6 +331,7 @@ See [the credential schema](axi-credential.schema.json) for profile fields and e
 Inline tokens and secret arguments are refused.
 Resolved credentials are redacted from response and error string values before TOON serialization, including their JSON-escaped and URL-encoded forms.
 Redaction also masks recognized secret fields, secret query values, URL credentials, JWTs, private keys and account keys.
+Generated confirmation IDs and fixed confirmation/reconciliation instructions remain intact when they overlap a protected value; payloads and upstream response text remain subject to redaction.
 The complete environment profile uses `GITEA_AXI_ORIGIN`, `GITEA_AXI_TOKEN_ORIGIN` and a JSON SecretRef in `GITEA_AXI_TOKEN`.
 Set `GITEA_AXI_ALLOW_INSECURE_HTTP=true` to permit HTTP for that environment profile; only the exact values `true` and `false` are accepted.
 HTTP requires `allowInsecureHttp: true` on that exact profile; a runtime origin override cannot reuse the token for another origin.
@@ -389,7 +420,7 @@ Set `GITEA_AXI_REPORT` to retain their reports at a chosen path.
 Their default reports go to unique files in the OS temporary directory; temporary installation files are removed.
 For S5, set `GITEA_AXI_REPORT_DIR` to an existing directory to retain `S5.1.json` or `S5.2.json`; otherwise only a console summary is emitted.
 
-`npm test` first runs the package-contract check in `scripts/verify-package.ts`, then the offline live-read regressions in `scripts/verify-live-reads.ts`, then the installed-package checks with local Gitea fakes for S1.1, S2.1 through S2.4, S3.1 through S3.5, S4.1 through S4.3, S5.1, S5.2 and S6.1 through S6.4 under an inherited outbound network guard.
+`npm test` first runs the package-contract check in `scripts/verify-package.ts`, then the native Git workspace checks in `scripts/verify-git.ts`, then the offline live-read regressions in `scripts/verify-live-reads.ts`, then the installed-package checks with local Gitea fakes for S1.1, S2.1 through S2.4, S3.1 through S3.5, S4.1 through S4.3, S5.1, S5.2 and S6.1 through S6.4 under an inherited outbound network guard.
 The package-contract check builds, packs and installs offline, validates the tarball file list and bin entry, smoke-tests the installed `--help` and `--version`, parses the consumed JSON artifacts and imports the modules Artium consumes from the installed package.
 Run it independently with `node --import ./scripts/deny-network.ts scripts/verify-package.ts`.
 Each S2 task also has an independent entrypoint, for example `node scripts/verify.mjs --task S2.3`.
@@ -412,4 +443,4 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for contribution rules.
 
 ## License
 
-No license file is published in this repository yet; licensing is pending.
+This project is licensed under the MIT License. See [LICENSE](LICENSE).

package/dist/api.js

@@ -30,7 +30,11 @@ for (const definition of Object.values(vendor.definitions)) {
     }
 }
 const requestDefinitions = structuredClone(vendor.definitions);
-for (const [name, fields] of Object.entries({ PullRequest: ['merge_commit_sha'], ContentsResponse: ['submodule_git_url', 'target'] })) {
+for (const [name, fields] of Object.entries({
+    PullRequest: ['merge_commit_sha'],
+    ContentsResponse: ['submodule_git_url', 'target', 'content', 'encoding', 'download_url', 'html_url', 'git_url'],
+    FileLinksResponse: ['git', 'html'],
+})) {
     for (const field of fields) {
         const properties = vendor.definitions[name].properties;
         properties[field] = { anyOf: [properties[field], { type: 'null' }] };
@@ -45,7 +49,11 @@ export function object(value) {
 }
 export function effectFor(method, path) {
     path = canonicalPath(path);
-    return routes.find(route => route.method === method && new RegExp('^' + route.path.split(/(\{[^}]+\})/).map(part => /^\{[^}]+\}$/.test(part) ? '[^/]+' : part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('') + '$').test(path.split('?')[0]));
+    return routes.find(route => route.method === method && new RegExp('^' + route.path.split(/(\{[^}]+\})/).map(part => {
+        if (/^\{[^}]+\}$/.test(part))
+            return route.multiSegmentParameters?.includes(part.slice(1, -1)) ? '[^/]+(?:/[^/]+)*' : '[^/]+';
+        return part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    }).join('') + '$').test(path.split('?')[0]));
 }
 export function canonicalPath(path) {
     const pathname = path.split('?')[0];
@@ -96,7 +104,8 @@ export function validate(path, value) {
     if (route.schema) {
         let validator = validators.get(route.path);
         if (!validator) {
-            validator = ajv.compile({ ...route.schema, definitions: vendor.definitions });
+            const schema = route.operation === 'repoGetContents' ? { anyOf: [route.schema, { type: 'array', items: route.schema }] } : route.schema;
+            validator = ajv.compile({ ...schema, definitions: vendor.definitions });
             validators.set(route.path, validator);
         }
         if (!validator(value))
@@ -127,9 +136,9 @@ export function rawPath(input, method = 'GET') {
         throw new CliError('READ_ONLY', 'Unclassified API route');
     return path + (query ? '?' + query : '');
 }
-export async function read(client, path) {
+export async function read(client, path, signal) {
     routeFor(path.split('?')[0]);
-    const value = await client.get(path);
+    const value = await client.get(path, signal);
     return validate(path.split('?')[0], value);
 }
 export async function resolveCommit(client, base, ref) {
@@ -157,8 +166,9 @@ export async function rawRead(client, path) {
     const count = response.headers.get('x-total-count');
     return { data, total: count && /^\d+$/.test(count) ? Number(count) : null, next: nextPage(response.headers, path, client.origin), truncated: false };
 }
-export async function collect(client, path, envelope) {
-    let next = path + (path.includes('?') ? '&' : '?') + 'limit=50&page=1';
+export async function collect(client, path, envelope, signal) {
+    const paginated = routeFor(path).paginated;
+    let next = paginated ? path + (path.includes('?') ? '&' : '?') + 'limit=50&page=1' : path;
     const seenPages = new Set();
     const items = new Map();
     let total = null;
@@ -166,14 +176,14 @@ export async function collect(client, path, envelope) {
         if (seenPages.has(next))
             throw new CliError('INVALID_RESPONSE', 'Gitea repeated a pagination URL');
         seenPages.add(next);
-        const response = await client.request(next);
+        const response = await client.request(next, false, undefined, signal);
         const data = validate(new URL(next, client.origin).pathname, response.data);
         const rows = envelope ? object(data)[envelope] : data;
         if (!Array.isArray(rows))
             throw new CliError('INVALID_RESPONSE', 'Expected a Gitea list' + (envelope ? ' envelope ' + envelope : ''));
         for (const value of rows) {
             const row = object(value);
-            const id = /\/(?:tags|actions\/(?:secrets|variables))$/.test(path.split('?')[0]) ? row.name : row.id ?? row.number ?? row.sha ?? row.filename ?? (row.user && row.content ? String(object(row.user).id) + ':' + row.content : undefined);
+            const id = /\/(?:tags|actions\/(?:secrets|variables))$/.test(path.split('?')[0]) ? row.name : row.id ?? row.number ?? row.sha ?? row.ref ?? row.sub_url ?? row.filename ?? (row.user && row.content ? String(object(row.user).id) + ':' + row.content : undefined);
             if (typeof id !== 'number' && typeof id !== 'string')
                 throw new CliError('INVALID_RESPONSE', 'List record has no identity');
             items.set(String(id), row);
@@ -185,11 +195,11 @@ export async function collect(client, path, envelope) {
             total = object(data).total_count;
         const link = response.headers.get('link');
         next = nextPage(response.headers, path, client.origin);
-        if (!next && !link && rows.length >= 50) {
+        if (paginated && !next && !link && rows.length >= 50) {
             const url = new URL([...seenPages].at(-1), client.origin);
             url.searchParams.set('page', String(Number(url.searchParams.get('page')) + 1));
             next = url.pathname + url.search;
         }
     }
-    return { items: [...items.values()], total, next, truncated: next !== null };
+    return { items: [...items.values()].slice(0, 1000), total: total ?? (!paginated && !next ? items.size : null), next, truncated: next !== null || items.size > 1000 };
 }

package/dist/credentials.js

@@ -35,6 +35,11 @@ function validateProfile(profile) {
 const secrets = [];
 export function registerSecret(value) { if (value)
     secrets.push(value); }
+const controls = new Set();
+export function controlText(value) {
+    controls.add(value);
+    return value;
+}
 export function redact(value) {
     if (Array.isArray(value))
         return value.map(redact);
@@ -43,6 +48,10 @@ export function redact(value) {
             /^(?:token|access_token|refresh_token|password|secret|authorization|private_key)$/i.test(key) ? '[REDACTED]' : redact(item)]));
     if (typeof value !== 'string')
         return value;
+    // Callers register only generated control text, never payloads or upstream response text.
+    const preserved = [...controls].filter(text => value.includes(text)).sort((a, b) => b.length - a.length);
+    if (preserved.length)
+        return value.split(new RegExp('(' + preserved.map(text => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|') + ')')).map(part => controls.has(part) ? part : redact(part)).join('');
     let output = value;
     for (const secret of secrets) {
         for (const form of [secret, JSON.stringify(secret).slice(1, -1), encodeURIComponent(secret)]) {

package/dist/git.js

@@ -43,9 +43,9 @@ export class Git {
         if (!isAbsolute(this.cwd) || await realpath(this.cwd) !== this.cwd || await this.run(['rev-parse', '--show-toplevel']) !== this.cwd) {
             throw new CliError('USAGE', '--workspace must be the absolute native repository root', 2);
         }
-        const config = await this.run(['config', '--local', '--name-only', '--list']) + '\n' +
-            await this.run(['config', '--worktree', '--name-only', '--list']);
-        if (config.split('\n').some(key => /^(?:url\.|http\.|credential\.|include\.|includeif\.|filter\.|diff\.|core\.sshcommand$|remote\..*\.(?:proxy|uploadpack|receivepack|pushurl|vcs)$)/i.test(key))) {
+        const config = await this.run(['config', '--no-includes', '--show-scope', '--name-only', '--list']);
+        // Inspect repository settings without requiring config.worktree or rejecting our command-scope transport settings.
+        if (config.split('\n').some(key => /^(?:local|worktree)\t(?:url\.|http\.|credential\.|include\.|includeif\.|filter\.|diff\.|core\.sshcommand$|remote\..*\.(?:proxy|uploadpack|receivepack|pushurl|vcs)$)/i.test(key))) {
             throw new CliError('UNSAFE_GIT_CONFIG', 'Workspace transport overrides must be removed before using origin-bound Git');
         }
         return this;

package/dist/main.js

@@ -19,6 +19,7 @@ import { actionValues, valuePlan } from './action-values.js';
 import { assetPath, attachToPlan, download, uploadPlan } from './attachments.js';
 import { isLocal, localWorkflow, validateLocal } from './local-workflows.js';
 import { capabilityOutput, commandGap } from './catalogue.js';
+import { diffOutput, maxOutputChars } from './output.js';
 async function input(path) {
     if (path !== '-')
         return readPrivateFile(path, true, 1_000_000);
@@ -42,7 +43,7 @@ export async function main(args) {
         if (args.some(arg => /^--(?:token|api-key|password|authorization)(?:=|$)/i.test(arg))) {
             throw new CliError('CONFIG_INVALID', 'token and other secret arguments are not accepted');
         }
-        const command = args.length === 0 || args[0]?.startsWith('--') ? commands.find(command => command.path[0] === 'dashboard') :
+        const command = args.length === 0 || args[0]?.startsWith('-') ? commands.find(command => command.path[0] === 'dashboard') :
             [...commands].sort((a, b) => b.path.length - a.path.length).find(command => command.path.every((part, index) => args[index] === part));
         if (!command) {
             const children = commands.filter(command => command.path[0] === args[0]);
@@ -54,7 +55,7 @@ export async function main(args) {
         }
         const path = command.path;
         operation = command.path.join(' ');
-        const rest = args[0]?.startsWith('--') || !args.length ? args : args.slice(path.length);
+        const rest = args[0]?.startsWith('-') || !args.length ? args : args.slice(path.length);
         let parsed;
         try {
             const options = Object.fromEntries(Object.entries(command.flags).map(([name, flag]) => [name, { type: flag.type,
@@ -119,7 +120,7 @@ export async function main(args) {
             });
             const output = await localWorkflow(new Client(identity.origin, identity.token, 300_000), identity, operation, positionals, options);
             const rendered = encode(redact(output));
-            if (rendered.length > 100_000)
+            if (rendered.length > maxOutputChars)
                 throw new CliError('OUTPUT_LIMIT', 'Rendered output exceeds 100000 characters');
             console.log(rendered);
             return;
@@ -359,12 +360,11 @@ export async function main(args) {
             else if (operation === 'pr diff') {
                 const response = await client.request(base + '/pulls/' + positionals[0] + '.diff', true);
                 const text = String(response.data);
-                const ceiling = options.full ? 100_000 : 10_000;
-                output = { diff: text.slice(0, ceiling), chars: text.length, truncated: text.length > ceiling, ...(text.length > ceiling ? { help: 'Use --full within the 100000 character diff ceiling' } : {}) };
+                output = diffOutput(text, Boolean(options.full));
             }
         }
         const rendered = encode(redact(output));
-        if (rendered.length > 100_000)
+        if (rendered.length > maxOutputChars)
             throw new CliError('OUTPUT_LIMIT', 'Rendered output exceeds 100000 characters; select fewer fields or a lower --limit');
         console.log(rendered);
     }

package/dist/output.js

@@ -0,0 +1,56 @@
+import { encode } from '@toon-format/toon';
+import { redact } from './credentials.js';
+export const maxOutputChars = 100_000;
+// Reserve the newline added by console.log.
+const fits = (value) => encode(redact(value)).length < maxOutputChars;
+function summary(value) {
+    if (Array.isArray(value))
+        return { summary: true, total_items: value.length };
+    if (value && typeof value === 'object') {
+        const row = value;
+        return { summary: true, total_fields: Object.keys(row).length,
+            ...(typeof row.id === 'number' ? { id: row.id } : {}), ...(typeof row.number === 'number' ? { number: row.number } : {}) };
+    }
+    return typeof value === 'string' ? { summary: true, total_chars: value.length } : value;
+}
+export function writeOutput(value) {
+    const displayed = { ...value };
+    const truncated = [];
+    // Keep requested effects complete; project only their verification context.
+    for (const field of ['preconditions', 'observations', 'results']) {
+        if (fits(displayed))
+            return displayed;
+        if (!(field in value))
+            continue;
+        const context = value[field];
+        if (field === 'observations' && Array.isArray(context)) {
+            displayed[field] = context.slice(0, 10).map(row => ({ path: row.path, data: summary(row.data) }));
+            displayed.observations_total = context.length;
+        }
+        else if (field === 'results' && Array.isArray(context)) {
+            displayed[field] = context.slice(0, 10).map(summary);
+            displayed.results_total = context.length;
+        }
+        else
+            displayed[field] = summary(context);
+        truncated.push(field);
+        displayed.truncated = true;
+        displayed.truncated_fields = [...truncated];
+    }
+    return displayed;
+}
+export function diffOutput(text, full) {
+    const candidate = (length) => ({ diff: text.slice(0, length), chars: text.length, truncated: text.length > length,
+        ...(text.length > length ? { help: full ? 'Diff is bounded to the rendered output ceiling' : 'Use --full for a larger bounded diff' } : {}) });
+    let low = 0, high = Math.min(text.length, full ? maxOutputChars : 10_000);
+    if (fits(candidate(high)))
+        return candidate(high);
+    while (low < high) {
+        const middle = Math.ceil((low + high) / 2);
+        if (fits(candidate(middle)))
+            low = middle;
+        else
+            high = middle - 1;
+    }
+    return candidate(low);
+}

package/dist/pulls.js

@@ -7,7 +7,27 @@ const sorted = (values) => [...values].sort();
 const equal = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 const delta = (previous, add, remove) => [...new Set([...previous.map(String), ...names(add)])].filter(value => !names(remove).includes(value));
 const members = (pull, field, key) => (pull[field] ?? []).map(row => object(row)[key]);
+function branchPath(base, branch) {
+    const segments = branch.split('/');
+    if (segments.some(segment => !segment || segment === '.' || segment === '..') || /[\s\\\x00-\x1f\x7f]/.test(branch))
+        usage('Select a branch without unsafe path segments');
+    return base + '/git/refs/heads/' + segments.map(encodeURIComponent).join('/');
+}
+function branchSHA(value, branch) {
+    if (!Array.isArray(value))
+        throw new CliError('INVALID_RESPONSE', 'Expected branch references');
+    const selected = value.map(object).find(row => row.ref === 'refs/heads/' + branch);
+    if (!selected)
+        throw new CliError('NOT_FOUND_OR_HIDDEN', 'The selected branch is missing or hidden');
+    const commit = object(selected.object);
+    if (commit.type !== 'commit' || typeof commit.sha !== 'string' || !/^[a-f0-9]{40}$/.test(commit.sha))
+        throw new CliError('INVALID_RESPONSE', 'Expected an immutable branch commit identity');
+    return commit.sha;
+}
 export function validatePull(operation, options) {
+    for (const ref of [options.head, options.base])
+        if (ref !== undefined)
+            branchPath('', String(ref));
     if (operation === 'pr review') {
         if (['approve', 'request-changes', 'comment'].filter(key => options[key]).length !== 1)
             usage('Choose exactly one of --approve, --request-changes or --comment');
@@ -49,6 +69,7 @@ export async function pullPlan(client, operation, base, number, options) {
         reads.add(path);
         return value;
     };
+    const snapshotBranch = async (branch) => branchSHA(await snapshot(branchPath(base, branch), true), branch);
     const add = (method, path, payload) => steps.push({ method, path, ...(payload === undefined ? {} : { payload }) });
     const before = action === 'create' ? undefined : object(await snapshot(path));
     const expected = before ? { id: before.id, number: before.number, ...fields(before), merged: before.merged ?? false, headSHA: object(before.head).sha } :
@@ -101,15 +122,14 @@ export async function pullPlan(client, operation, base, number, options) {
             payload.assignees = names(options.assignee);
             expected.reviewers = sorted(addedReviewers);
             expected.teams = sorted(names(options['team-reviewer']));
-            const head = object(await snapshot(base + '/branches/' + encodeURIComponent(String(options.head))));
-            expected.headSHA = object(head.commit).id;
+            expected.headSHA = await snapshotBranch(String(options.head));
         }
         else {
             if (options['add-assignee'] !== undefined || options['remove-assignee'] !== undefined)
                 payload.assignees = delta(expected.assignees, options['add-assignee'], options['remove-assignee']);
         }
         if (options.base !== undefined)
-            await snapshot(base + '/branches/' + encodeURIComponent(String(options.base)));
+            await snapshotBranch(String(options.base));
         if (options.milestone !== undefined) {
             const list = await snapshot(base + '/milestones?state=all', true);
             const selected = list.find(row => row.title === options.milestone);
@@ -171,12 +191,12 @@ export async function pullPlan(client, operation, base, number, options) {
             payload.MergeMessageField = options.body;
         if (style === 'rebase')
             await snapshot(path + '/commits', true);
-        await snapshot(base + '/branches/' + encodeURIComponent(String(expected.base)));
+        await snapshotBranch(String(expected.base));
         add('POST', path + '/merge', payload);
         expected.state = 'closed';
     }
     else if (action === 'update-branch') {
-        await snapshot(base + '/branches/' + encodeURIComponent(String(expected.base)));
+        await snapshotBranch(String(expected.base));
         add('POST', path + '/update');
     }
     if (action === 'comment' || action === 'close' && options.comment !== undefined) {
@@ -228,8 +248,8 @@ export async function verifyPull(client, plan, results, observations) {
     }
     if (action !== 'merge' && action !== 'update-branch')
         return;
-    const branchPath = base + '/branches/' + encodeURIComponent(String(expected.base));
-    const baseSHA = object(object(before[branchPath]).commit).id;
+    const baseBranchPath = branchPath(base, String(expected.base));
+    const baseSHA = branchSHA(before[baseBranchPath], String(expected.base));
     const commit = async (sha) => {
         if (typeof sha !== 'string' || !/^[a-f0-9]{40}$/.test(sha))
             return mismatch();
@@ -241,25 +261,29 @@ export async function verifyPull(client, plan, results, observations) {
         return data;
     };
     if (action === 'update-branch') {
-        const head = await commit(object(pull.head).sha);
-        const pending = [head], visited = new Set();
-        while (pending.length && visited.size < 1000) {
-            const current = pending.pop();
-            if (visited.has(current.sha))
+        const required = new Set([baseSHA, expected.headSHA]);
+        if ([...required].some(sha => typeof sha !== 'string' || !/^[a-f0-9]{40}$/.test(sha)))
+            mismatch();
+        const pending = [object(pull.head).sha], visited = new Set();
+        for (let cursor = 0; cursor < pending.length && visited.size < 1000; cursor++) {
+            const sha = pending[cursor];
+            if (visited.has(sha))
                 continue;
+            const current = await commit(sha);
             visited.add(current.sha);
-            if (visited.has(baseSHA) && visited.has(expected.headSHA))
+            required.delete(current.sha);
+            const parents = members(current, 'parents', 'sha');
+            for (const parent of parents)
+                required.delete(parent);
+            if (!required.size)
                 return;
-            for (const parent of members(current, 'parents', 'sha')) {
-                if (!visited.has(parent))
-                    pending.push(await commit(parent));
-            }
+            pending.push(...parents.filter(parent => !visited.has(parent)));
         }
         mismatch();
     }
     if (pull.merged !== true || !pull.merge_commit_sha)
         mismatch();
-    const finalSHA = object(object(observation(branchPath)).commit).id;
+    const finalSHA = branchSHA(observation(baseBranchPath), String(expected.base));
     if (finalSHA !== pull.merge_commit_sha)
         mismatch();
     const final = await commit(finalSHA);

package/dist/reads.js

@@ -111,8 +111,8 @@ export async function listIssues(client, base, kind, options) {
         truncated: page.truncated || rows.length > limit, next: page.next, continuation: page.truncated || rows.length > limit,
         help: [`gitea-axi ${kind} view <number> --repo ${base.split('/').slice(-2).join('/')}`, ...continuationHelp(page, rows.length, limit)] };
 }
-async function complete(client, path) {
-    const page = await collect(client, path);
+async function complete(client, path, signal) {
+    const page = await collect(client, path, undefined, signal);
     if (page.truncated)
         throw new CliError('RESPONSE_LIMIT', 'Related collection exceeds the bounded read; use the raw API to page explicitly');
     return page.items;
@@ -127,11 +127,11 @@ async function reviews(client, path, full) {
     }
     return result;
 }
-export async function checks(client, base, sha) {
-    const combined = object(await read(client, base + '/commits/' + encodeURIComponent(sha) + '/status'));
+export async function checks(client, base, sha, signal) {
+    const combined = object(await read(client, base + '/commits/' + encodeURIComponent(sha) + '/status', signal));
     if (combined.sha !== sha && !(combined.sha === '' && combined.total_count === 0 && (combined.statuses === null || Array.isArray(combined.statuses) && !combined.statuses.length)))
         throw new CliError('INVALID_RESPONSE', 'Check response does not match the pull request head SHA');
-    const statuses = await complete(client, base + '/commits/' + encodeURIComponent(sha) + '/statuses');
+    const statuses = await complete(client, base + '/commits/' + encodeURIComponent(sha) + '/statuses', signal);
     statuses.sort((a, b) => Number(b.id) - Number(a.id));
     const latest = new Map();
     for (const status of statuses)
@@ -146,28 +146,37 @@ export async function checks(client, base, sha) {
 export async function watchChecks(client, base, number, options) {
     const seconds = positive(options.timeout, 30, 3600);
     const interval = positive(options.interval, 5, 60) * 1000;
-    const stop = Date.now() + seconds * 1000;
+    const stop = Math.min(client.deadline, Date.now() + seconds * 1000);
     const controller = new AbortController();
+    let head = null;
+    let latest;
     const cancel = () => controller.abort();
     process.once('SIGINT', cancel);
     process.once('SIGTERM', cancel);
     try {
         while (true) {
-            const pull = object(await read(client, base + '/pulls/' + number));
+            const pull = object(await read(client, base + '/pulls/' + number, controller.signal));
             const sha = object(pull.head).sha;
             if (typeof sha !== 'string' || !sha)
                 throw new CliError('INVALID_RESPONSE', 'Pull request head SHA is missing');
-            const result = await checks(client, base, sha);
+            head = sha;
+            const result = await checks(client, base, sha, controller.signal);
+            latest = result;
             if (!options.watch || result.items.length > 0 && !result.pending || result.failed || Date.now() >= stop || controller.signal.aborted)
-                return { ...result, cancelled: controller.signal.aborted };
+                return { ...result, exitCode: controller.signal.aborted ? 8 : result.exitCode, cancelled: controller.signal.aborted };
             await delay(Math.min(interval, Math.max(1, stop - Date.now())), undefined, { signal: controller.signal }).catch(error => {
                 if (!controller.signal.aborted)
                     throw error;
             });
             if (Date.now() >= stop || controller.signal.aborted)
-                return { ...result, cancelled: controller.signal.aborted };
+                return { ...result, exitCode: controller.signal.aborted ? 8 : result.exitCode, cancelled: controller.signal.aborted };
         }
     }
+    catch (error) {
+        if (!controller.signal.aborted)
+            throw error;
+        return { ...(latest ?? { head, items: [], passed: 0, failed: 0, pending: 0 }), exitCode: 8, cancelled: true };
+    }
     finally {
         process.removeListener('SIGINT', cancel);
         process.removeListener('SIGTERM', cancel);
@@ -196,7 +205,8 @@ export async function view(client, base, kind, number, options) {
                 headRepository: head.repo == null ? null : { name: object(head.repo).name, nameWithOwner: object(head.repo).full_name },
                 headRepositoryOwner: head.repo == null ? null : user(object(head.repo).owner), isCrossRepository: head.repo_id == null || tail.repo_id == null ? null : head.repo_id !== tail.repo_id,
                 mergeCommit: row.merge_commit_sha ? { oid: row.merge_commit_sha } : null, mergedBy: user(row.merged_by),
-                mergeable: row.mergeable == null ? 'UNKNOWN' : row.mergeable ? 'MERGEABLE' : 'CONFLICTING', reviewRequests: users(row.requested_reviewers) });
+                mergeable: row.mergeable == null ? 'UNKNOWN' : row.mergeable ? 'MERGEABLE' : 'CONFLICTING', reviewRequests: [...users(row.requested_reviewers),
+                    ...(row.requested_reviewers_teams ?? []).map(team => ({ type: 'team', id: team.id, name: team.name }))] });
         }
         if (options.reviews || requested.has('reviews') || requested.has('latestReviews')) {
             const all = await reviews(client, path, Boolean(options.full || fields));

package/dist/registry.js

@@ -91,7 +91,7 @@ const definitions = [
     ['pr view', { ...repo, ...detail, reviews: { type: 'boolean' }, checks: { type: 'boolean' } }],
     ['pr checks', { ...repo, watch: { type: 'boolean' }, timeout: { type: 'string', description: 'Watch deadline seconds, required with --watch' }, interval: { type: 'string', description: 'Watch interval seconds, default 5' } }],
     ['pr diff', { ...repo, full: detail.full }],
-    ['release list', { ...repo, limit: list.limit, 'exclude-drafts': { type: 'boolean' }, 'exclude-pre-releases': { type: 'boolean' } }],
+    ['release list', { ...repo, limit: { ...list.limit, description: 'Maximum returned records, default 10, maximum 1000' }, 'exclude-drafts': { type: 'boolean' }, 'exclude-pre-releases': { type: 'boolean' } }],
     ['release view', { ...repo, full: detail.full }], ['api', { ...writeFlags,
             method: { type: 'string', short: 'X', description: 'HTTP method; cannot combine with a positional method' },
             field: { type: 'string', multiple: true, description: 'Repeatable key=value; numbers, booleans and null become JSON values' },